ID-0002Severity: high
Session Token Theft: Multi-Factor Authentication Without a Multi-Factor Prompt
Adversary-in-the-middle phishing does not defeat MFA by breaking it. It waits until MFA has already succeeded, then takes what MFA produced.
Identity & Access3 min